General
-
Target
1d85ccc8254dfd89e23bfc5dfae6391d23e572bb02e84139de14e6b8795db07c
-
Size
219KB
-
Sample
230626-dz9yzsgb97
-
MD5
2a86806fa6c48aa8c84b60baf67b211c
-
SHA1
333b7c6f66a7c4cf31d1af9029240eac71618a53
-
SHA256
1d85ccc8254dfd89e23bfc5dfae6391d23e572bb02e84139de14e6b8795db07c
-
SHA512
c2e6946e37c2e6533113ece228a2d6c94a0c040bdbbea07324ffcde22ede453bb5b3d9b799bd6495d260c21a9ed6685bb3b8ea8b8b53d1cdc9af58169198e6b7
-
SSDEEP
6144:ZwmfyxKNt96lONXiEy3B7Q3T2si4kVZpZlu3OYwZstX2J:ZwmawR6+XupQ3TLiXfhstX2J
Behavioral task
behavioral1
Sample
1d85ccc8254dfd89e23bfc5dfae6391d23e572bb02e84139de14e6b8795db07c.exe
Resource
win7-20230621-en
Behavioral task
behavioral2
Sample
1d85ccc8254dfd89e23bfc5dfae6391d23e572bb02e84139de14e6b8795db07c.exe
Resource
win10v2004-20230621-en
Malware Config
Extracted
cobaltstrike
1359593325
http://salofu.com:443/favicon.html
-
access_type
512
-
beacon_type
2048
-
host
salofu.com,/favicon.html
-
http_header1
AAAACgAAABFDb25uZWN0aW9uOiBjbG9zZQAAAAoAAAATQWNjZXB0LUVuY29kaW5nOiBicgAAAAoAAAAlQWNjZXB0LUxhbmd1YWdlOiBlbi1HQjtxPTAuOSwgKjtxPTAuNwAAAAcAAAAAAAAACAAAAAMAAAACAAAAGndvb2NvbW1lcmNlX2l0ZW1zX2luX2NhcnQ9AAAABgAAAAZDb29raWUAAAAJAAAADUNvbW1lbnQ9ZmFsc2UAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
-
http_header2
AAAACgAAABFDb25uZWN0aW9uOiBjbG9zZQAAAAoAAAA9QWNjZXB0LUxhbmd1YWdlOiBmci1DSCwgZnI7cT0wLjksIGVuO3E9MC44LCBkZTtxPTAuNywgKjtxPTAuNQAAAAoAAAAYQ29udGVudC1UeXBlOiB0ZXh0L3BsYWluAAAABwAAAAEAAAANAAAAAwAAAAQAAAAHAAAAAAAAAAMAAAACAAAADl9fc2Vzc2lvbl9faWQ9AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
-
http_method1
GET
-
http_method2
POST
-
jitter
10496
-
polling_time
55046
-
port_number
443
-
sc_process32
%windir%\syswow64\regsvr32.exe
-
sc_process64
%windir%\sysnative\regsvr32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCYpy36fhBOB0HWByW9Zums0LDB7FU7EBB1wu6PxzRrd0Nge4MbzVGsEP3yTL9qxNSXGKzCVTXNfc2LXZ1fmAx4rjWsMiieCDupafyl2Mp7fzHvdB485F3aVLCrqDrOaznWAUkuuUExOMbcZwxwnG9u361pW4Ba2FPQQPmFX6fkBwIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4.43751424e+08
-
unknown2
AAAABAAAAAIAAAFSAAAAAwAAAA0AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/mobile-home
-
user_agent
Mozilla/5.0 (Linux; Android 8.0.0; SM-G960F Build/R16NW) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/62.0.3202
-
watermark
1359593325
Targets
-
-
Target
1d85ccc8254dfd89e23bfc5dfae6391d23e572bb02e84139de14e6b8795db07c
-
Size
219KB
-
MD5
2a86806fa6c48aa8c84b60baf67b211c
-
SHA1
333b7c6f66a7c4cf31d1af9029240eac71618a53
-
SHA256
1d85ccc8254dfd89e23bfc5dfae6391d23e572bb02e84139de14e6b8795db07c
-
SHA512
c2e6946e37c2e6533113ece228a2d6c94a0c040bdbbea07324ffcde22ede453bb5b3d9b799bd6495d260c21a9ed6685bb3b8ea8b8b53d1cdc9af58169198e6b7
-
SSDEEP
6144:ZwmfyxKNt96lONXiEy3B7Q3T2si4kVZpZlu3OYwZstX2J:ZwmawR6+XupQ3TLiXfhstX2J
Score10/10 -